Translation in progress Some entries still include text in the original language.
Oct 13 · Tuesday
All papers Found 76 papers Another 201 papers do not have category tags yet and are not included in filtered results.
“
About this collection Collection in progress We are building a large AI safety paper collection to help researchers find work related to their interests. Papers are collected automatically andfiltered only for relevance to AI safety , without judging quality, novelty or reading value. The default “Annotated first” shows papers with tags or published paper analyses first. Each group is ordered by original publication date, newest first, with undated papers last. “Newest first” uses publication dates only. This order is not a quality ranking.
One-line summaries, tags and paper analyses are prepared by AI from the papers. Language models may have systematic biases and produce hallucinations.We plan to carry out human annotation and review to reduce errors in this content.
Proposes the Cancerous backdoor, which progressively corrupts reasoning using invisible stage tokens.
Published Oct 9
Evaluated models Llama-3.1-8B-Instruct , Qwen2.5-7B-Instruct , Mistral-7B-Instruct-v0.3 Abstract Hidden tokens plus a stage controller make the backdoor progressively corrupt reasoning upon triggering, and the authors believe that looking only at the answer will miss it.Cancerous Backdoor Attack changes LLM backdoors from one-time activation to multi-stage reasoning corruption that accumulates progressively with triggers.
Uses premise permutation and hidden-layer tracing to audit whether legal chain-of-thought truly relies on the cited legal provisions.
Published Oct 9
Evaluated models Qwen3-8B , Qwen3-14B , Llama-3.1-8B and others7 Abstract Using counterfactual substitution of authorities and internal commitment tracing, the authors find that legal CoT rulings depend on authorities only to a limited extent and are vulnerable to prompt injection manipulation.This study conducts an empirical audit of the causal truthfulness of legal citations in chain-of-thought reasoning of large language models in the legal domain.
度量关闭思考指令下终答前是否仍有可见显式推理
Published Oct 8
Evaluated models Qwen3-4B , Qwen3-32B , Qwen3-235B-A22B and others6 Abstract 作者用三级指标测 no-thinking，并称模型有随答案空间加重的思考惯性。作者把 no-thinking 定义为可测量的回答行为，而不是从思考开关、特殊标记或输出长度推断。
提出 RL-ARC，用推理置信度在强化学习中校准推理模型
Published Oct 8
Evaluated models Qwen2.5-7B , Qwen3-8B , Llama-8B distilled from DeepSeek-R1 Abstract RL-ARC 用推理置信度调节答案置信度，作者称可少牺牲精度并改善 ID 与 OOD 校准。RL-ARC 是校准感知的强化学习框架，用推理过程的口头置信度调节答案置信度。
提出路由 TopK SAE，把语音编码器稀疏码拆成语言与副语言通路
Published Oct 8
Evaluated models SPEAR XLarge , WavLM Large Abstract 路由 SAE 在冻结 SPEAR 与 WavLM 上分开语言和副语言因子，探针与交换支持通路分工。TopK SAE 的稀疏码被分成语言通路与副语言通路，用来分开冻结语音编码器里同时存在的音素信息和说话人、情感、韵律。只重构不能得到作者选定的这一分解。语言通路由音素识别监督，副语言通路由说话人识别、情感分类和韵律预测监督，作用在对方通路上的梯度反转对抗用来压低交叉因子。
检验推理 token 数能否区分被提示的诚实与不诚实作答
Published Oct 8
Evaluated models Gemma-4-e4b , Qwen-3.5-9b , GPT-OSS-120B Abstract 被提示不诚实时推理 token 组水平更高。三个推理模型在被提示的回答政策下出现组水平推理 token 差异。作者把它当作不读思维链内容的 black-box 候选信号，而不是自发欺骗检测器。
提出 FAB 攻击，向声学基础模型植入可由环境声触发的后门
Published Oct 7
Evaluated models HuBERT-base , WavLM-base Abstract 论文提出了针对声学基模的 FAB 后门攻击，在弱威胁模型下实现了任务无关、物理可触发的后门植入。
揭示推理模型用标识符规则替代随机抽样，使审计可被预测
Published Oct 7
Evaluated models GPT-6 Sol , GPT-6 Luna , GPT-5.4 mini and others6 Abstract 研究揭示推理智能体将标识符转化为确定性规则，破坏群体独立性并导致审计预测漏洞，建议显式提供随机输入。
提出 U-SPACE 与 U-LENS，从残差流估计推理轨迹不确定性
Published Oct 7
Evaluated models Gemma-4-31B-it , Qwen3.5-27B , Magistral-Small-2507 Abstract U-SPACE 与 U-LENS 用语义方向和预测熵读推理不确定性，长度控制后仍高于所比基线。U-SPACE 与 U-LENS 是面向推理模型的无训练读出：用语义方向定位不确定性的形式，并用一个轨迹分数区分更可能错的回答。
提出 VeriFine，用双环协同扩展验证以实现具身推理自我改进
Published Oct 7
Evaluated models Alpamayo 1.5 8B , Qwen3-VL 2B , Claude Opus 5 Abstract VeriFine 用双环协同演化具身推理的策略、课程和评审，驾驶与导航的策略分和评审对齐都上升。VeriFine 把驾驶和导航推理的自改进写成策略、课程和无参考评审的协同演化，用来处理固定评审跟不上新失败模式的问题。
用均值差激活转向检验全双工语音模型的情感方向几何
Published Oct 6
Evaluated models kyutai/moshika-pytorch-q8 Abstract 转向跟方向几何走而不跟标签走：sad 可单独对准，高唤醒情感共享方向。Moshi 上的情感激活转向跟方向之间的几何关系走，不跟被请求的标签走。
证明短开头词可唤醒基模型推理，且效应来自训练数据
Published Oct 6
Evaluated models Olmo-3-7B , Olmo-3-32B , Qwen3-4B and others10 提出 VERA，审计 LLM 漏洞解释里的虚构推理
Published Oct 5
Evaluated models sonnet-5 , gemma-4-26b , llama-4-maverick and others8 构建多语言音视频 DeepFake 基准 BabelFake 并评测检测器
Published Oct 5
Evaluated models SpeechForensics , AVH-Align , (B)RAVEn Abstract BabelFake 为五语同意采集基准。BabelFake 是经同意与 IRB 批准采集的多语音视频 DeepFake 检测基准，用来把视觉操纵和语音合成拆开比较。
提出任务感知的跨域蒸馏与剪枝方法以压缩音频深度伪造检测器
Published Oct 4
Evaluated models XLSR-AASIST 提出 THRIVE，为自回归 TTS 嵌入抗重建的多比特语音水印
Published Oct 3
Evaluated models Qwen3-TTS (0.6B) , Dots.tts (2B) 提出 OmniConfess，冻结候选并按通道重打分以缓解全模态幻觉
Published Oct 2
Evaluated models Qwen2.5-Omni-7B , Qwen3-Omni-30B-A3B , Nemotron-3-Nano-Omni-30B 系统评估循环语言模型加深 loop 后的 CoT 可监控性
Published Oct 2
Evaluated models Ouro-1.4B-Thinking , Ouro-2.6B-Thinking , Nanbeige4.2-3B and others4 Abstract 加深 loop 可在部分压力测试任务降低可监测性，循环架构本身并不必然更难监测。这项工作评估 LoopLM 的 CoT 可监测性：加深共享层的重复次数，以及“有循环结构”本身，会不会让决策关键因素更少出现在可监测文本里。
证明 RLVR 后训练允许无界语言漂移且限制漂移必限制奖励
Published Oct 2
Evaluated models gemma-3-1b-pt , Llama-3.2-1B , Qwen2.5-1.5B Abstract 论文证明并验证了 RLVR 在新任务上必然诱发独特的语言漂移，揭示了前沿推理模型可监控性的安全隐患。论文从理论与实验两方面研究了大语言模型在 RLVR 后训练过程中思维链出现的语言漂移现象。
测量三种长度压力训练对 CoT 忠实性与可监控性的影响
Published Oct 2
Evaluated models Qwen3-4B-Thinking-2507 , Qwen3-8B , Olmo3-7B-Think Abstract 效率训练多通过答案不一致损害忠实性。这项工作比较三种缩短 CoT 的 RL 训练，看监督用的推理痕迹还剩多少。